Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 00:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/jsiwek/gridftp'

Browse source 
* origin/topic/jsiwek/gridftp:
  Add memory leak unit test for GridFTP.
  Enable GridFTP detection by default.  Track/log SSL client certs.
  Add analyzer for GSI mechanism of GSSAPI FTP AUTH method.
  Add an example of a GridFTP data channel detection script.
This commit is contained in:
Robin Sommer 2012-10-12 10:32:39 -07:00
commit 5e12a53ae5
27 changed files with 583 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

20
testing/btest/scripts/base/protocols/conn/polling.test Normal file
View file

@ -0,0 +1,20 @@
# @TEST-EXEC: bro -b -r $TRACES/http-100-continue.trace %INPUT >out1
# @TEST-EXEC: btest-diff out1
# @TEST-EXEC: bro -b -r $TRACES/http-100-continue.trace %INPUT stop_cnt=2 >out2
# @TEST-EXEC: btest-diff out2
@load base/protocols/conn
const stop_cnt = 10 &redef;
function callback(c: connection, cnt: count): interval
{
print "callback", c$id, cnt;
return cnt >= stop_cnt ? -1 sec : .2 sec;
}
event new_connection(c: connection)
{
print "new_connection", c$id;
ConnPolling::watch(c, callback, 0, 0secs);
}

21
testing/btest/scripts/base/protocols/ftp/gridftp.test Normal file
View file

@ -0,0 +1,21 @@
# @TEST-EXEC: bro -r $TRACES/globus-url-copy.trace %INPUT
# @TEST-EXEC: btest-diff notice.log
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ssl.log
@load base/protocols/ftp/gridftp
module GridFTP;
redef size_threshold = 2;
redef enum Notice::Type += {
Data_Channel
};
event GridFTP::data_channel_detected(c: connection)
{
local msg = fmt("GridFTP data channel over threshold %d bytes",
size_threshold);
NOTICE([$note=Data_Channel, $msg=msg, $conn=c]);
}